nix-community/nix-on-droid-app
1
0
Fork 0
mirror of https://github.com/nix-community/nix-on-droid-app.git synced 2025-12-09 10:31:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Validate file path in TermuxOpenReceiver

Browse source
This commit is contained in:
Fredrik Fornwall 2017-10-28 16:19:58 +02:00
parent 3533b13de8
commit 092a83a688
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
app/src/main/java/com/termux/app/TermuxOpenReceiver.java
View file

@ -8,6 +8,7 @@ import android.content.Intent;
import android.database.Cursor; import android.database.Cursor;
import android.database.MatrixCursor; import android.database.MatrixCursor;
import android.net.Uri; import android.net.Uri;
import android.os.Environment;
import android.os.ParcelFileDescriptor; import android.os.ParcelFileDescriptor;
import android.provider.MediaStore; import android.provider.MediaStore;
import android.support.annotation.NonNull; import android.support.annotation.NonNull;
@ -18,6 +19,7 @@ import com.termux.terminal.EmulatorDebug;
import java.io.File; import java.io.File;
import java.io.FileNotFoundException; import java.io.FileNotFoundException;
import java.io.IOException;
public class TermuxOpenReceiver extends BroadcastReceiver { public class TermuxOpenReceiver extends BroadcastReceiver {
@ -171,6 +173,16 @@ public class TermuxOpenReceiver extends BroadcastReceiver {
@Override @Override
public ParcelFileDescriptor openFile(@NonNull Uri uri, @NonNull String mode) throws FileNotFoundException { public ParcelFileDescriptor openFile(@NonNull Uri uri, @NonNull String mode) throws FileNotFoundException {
File file = new File(uri.getPath()); File file = new File(uri.getPath());
try {
String path = file.getCanonicalPath();
String storagePath = Environment.getExternalStorageDirectory().getCanonicalPath();
// See https://support.google.com/faqs/answer/7496913:
if (!(path.startsWith(TermuxService.FILES_PATH) || path.startsWith(storagePath))) {
throw new IllegalArgumentException("Invalid path: " + path);
}
} catch (IOException e) {
throw new IllegalArgumentException(e);
}
return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY); return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY);
} }
} }